Northflank hack: every stored secret may be exposed, as stolen AI keys spread across developer platforms

Some Northflank users have found their AI keys working for someone else, running up calls they never made. After the Northflank hack, the company has told every customer to assume that all the secrets they stored with it were exposed, and to change them straight away.

Northflank is a cloud platform that developers use to run their apps. It holds “environment variables”: the passwords, database logins and AI access keys an app needs to work. Those keys are what attackers want most, and Northflank is the latest of at least nine AI developer platforms to report a break-in this month, according to the security firm Wiz.

Northflank hack timeline: from one alert to “change every key”

Northflank’s status page sets out the day in UTC. On 30 October, a Wiz threat alert arrived at 11:43, and engineers began patching the company’s network rules at 12:02, with more fixes at 12:50 and 13:05. At 13:40 it told users to change their environment variables. At 13:58 it went further: assume all of them “have been decrypted”, meaning read in plain text.

By 15:12, Northflank said several users had confirmed their AI keys had been used. It switched on secret rotation for Postgres and MongoDB databases run on the platform, and asked users to turn off public access to them.

At 19:28 it said it had “no further confirmed findings”. Its latest update, at 23:38, said users had reported unauthorised use of AI keys stored on the platform, and pointed to Wiz’s “Black October” report as a possible match.

As of 00:25 UTC on 31 October, there is no newer update. Northflank has not said how many customers were affected, who the attacker is, or how they got in.

Black October 2026: one wave, many doors

“Black October” is the name for this month’s run of security incidents, including the PHP2Shell flaw. Wiz’s report on Black October and AI platforms lists at least nine disclosures since 6 October, from Fireworks AI to Railway and Northflank. Wiz found no single shared weakness. The causes differ, from stolen logins to a third-party supplier, but every public report describes attackers hunting for stored keys, especially AI ones.

The biggest earlier case is the Railway data breach. Railway says it learned of “a sustained and targeted campaign” on 20 October, aimed at getting AI keys. It says at most 1.85% of workspaces, about 100,000, had some secrets potentially exposed.

The damage has a name: LLMjacking, which means using someone else’s stolen key to run AI services on their bill. Wiz says two stolen company keys made about 800,000 and 1.7 million AI calls, in roughly 30 and 13 hours, likely costing over US$100,000 at list price. The traffic, it adds, looked like keys resold to many buyers.

Rumour: Social media posts describe crypto theft and personal AI bills of hundreds to thousands of dollars. Wiz calls these anecdotal, and none is confirmed.

If your app ran on Northflank, start with the keys

A calm order of work. Steps 1 to 3 follow Northflank’s advice; 4 and 5 are good habits:

1. Cancel, don’t just copy. Revoke each old key with the company that issued it, then make a new one.
2. Update everywhere. Put the new keys into your workloads, secret groups and global secrets.
3. Check the bills. Read your AI usage and billing logs from 30 October onward, and report anything odd to Northflank and the provider.
4. Set a ceiling. Turn on spending limits or alerts with each AI provider.
5. One key per app. If a key leaks, you then change one app, not ten.

Should you rotate API keys if you never saw odd usage? Yes: right away after any breach, then on a regular schedule. Students and small businesses should move first, because a surprise bill hurts most there.

Why speed matters more than blame this week

On balance, Northflank’s public timeline deserves credit. Engineers were on the alert within a minute, customers heard the worst case the same afternoon, and updates kept coming into the night. That honesty gives users time to act. The fair criticism is that a platform holding so many keys must be built for this day before it comes.

The wider lesson is for the whole industry. A platform full of AI keys is now a target in its own right, because those keys turn straight into money. This suggests the fix is shorter-lived keys and default spending caps from AI providers, not just stronger walls. Still missing: how the attackers got in, and whether the door is truly shut.

The next update to watch is Northflank’s account of the root cause. Until then, the safest key is the one you changed tonight.